Ukrainian police and the Security Service of Ukraine said they shut down a network of fake investment platforms that used a crypto “drainer” to steal up to $1 million a month from victims in more than 20 countries. Investigators have so far identified 62 victims and said more than 46 Ukrainians took part in the alleged operation, according to CoinDesk reporting on the takedown.
How the Drainer Worked
Police said the fake platforms displayed climbing balances to convince users their investments were growing, with operators manually creating transactions and adjusting account balances to simulate gains. When victims tried to withdraw, the sites asked them to connect their main crypto wallets and approve what appeared to be a small test transaction. The hidden drainer then automatically moved the users’ funds to wallets controlled by the operators, after which victims were locked out of the platform entirely. The method required no seed phrase: by connecting a wallet and approving a single transaction, victims unwittingly granted the operators control over their funds.
An Operation Run From Kyiv
Investigators said the lead organizer, a 25-year-old IT specialist, recruited more than 46 citizens and ran several offices in Kyiv and the surrounding region. Technical staff built and maintained the fake sites, while other workers contacted potential victims. Beyond crypto, the platforms collected passport information, phone numbers, email addresses, login details, passwords and photographs during registration, exposing victims to identity theft and further fraud on top of the drained assets.
A Break Outside Ukraine
Police traced server equipment used by the group to the Netherlands and obtained access to a database stored there that listed victims, wallet addresses, amounts allegedly stolen and internal communications. Victims came from Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada and Israel, echoing other cross-border enforcement efforts such as the tri-nation raid that dismantled scam compounds in Dubai. The investigation remains ongoing, with the SBU and police working to identify additional victims and organizers. The recovered records included victim lists, crypto wallet addresses, amounts allegedly stolen and internal communications describing how the fake platforms operated, giving investigators a fuller map of the network’s scope.
